Vulnerability · Published Dec 18, 2020 · Assigned by mitre
CVE-2020-28052
High 8.1
In plain English
A high-severity security flaw in the bouncycastle package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.2% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.1High
Exploit odds (30 days)7.2%top 5.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | bouncycastle | 1.65-2 | DEBIAN-CVE-2020-28052 |
| Debian:13 | bouncycastle | 1.65-2 | DEBIAN-CVE-2020-28052 |
| Debian:14 | bouncycastle | 1.65-2 | DEBIAN-CVE-2020-28052 |
| Maven | org.bouncycastle:bcprov-ext-jdk15on | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-ext-jdk16 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk14 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk15 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk15on | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk15to18 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk16 | 1.67 | GHSA-73xv-w5gp-frxh |
| Ubuntu:22.04:LTS | bouncycastle | no fix listed | UBUNTU-CVE-2020-28052 |
| Ubuntu:24.04:LTS | bouncycastle | no fix listed | UBUNTU-CVE-2020-28052 |
| Ubuntu:25.10 | bouncycastle | no fix listed | UBUNTU-CVE-2020-28052 |
Affected products (as reported)
References
- https://www.bouncycastle.org/releasenotes.html x_refsource_MISC
- [druid-commits] 20210107 [GitHub] [druid] jon-wei opened a new pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052 mailing-list, x_refsource_MLIST
- [kafka-jira] 20210107 [GitHub] [kafka] cyrusv opened a new pull request #9845: MINOR: Bump Bouncy Castle Dep to resolve CVE-2020-28052 mailing-list, x_refsource_MLIST
- [druid-commits] 20210107 [GitHub] [druid] clintropolis merged pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052 mailing-list, x_refsource_MLIST
- [pulsar-commits] 20210119 [GitHub] [pulsar] fmiguelez opened a new issue #9235: Upgrade Bounce Castle dependency on client to solve CVE-2020-28052 mailing-list, x_refsource_MLIST
- [druid-commits] 20210127 [druid] 01/02: Update deps for CVE-2020-28168 and CVE-2020-28052 (#10733) mailing-list, x_refsource_MLIST
- [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari commented on issue #9235: Upgrade Bounce Castle dependency on client to solve CVE-2020-28052 mailing-list, x_refsource_MLIST
- [solr-issues] 20210525 [jira] [Created] (SOLR-15431) Security vulnerability with Bouncy Castle library within Apache Solr 8.8.2 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://github.com/bcgit/bc-java/wiki/CVE-2020-28052 x_refsource_MISC
- https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle/ x_refsource_MISC
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- [karaf-issues] 20210810 [jira] [Created] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210810 [jira] [Updated] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210810 [jira] [Commented] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210816 [jira] [Updated] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210816 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.69 artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210817 [jira] [Commented] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210817 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210820 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210824 [jira] [Commented] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- [karaf-issues] 20210824 [jira] [Resolved] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC